Skip to content
Noroxi

My Calendar – Accessible Event Manager

my-calendar · plugin

Known security vulnerabilities for My Calendar – Accessible Event Manager. Find out in seconds which version runs on your site with WP Lens.

12 known vulnerabilities

5 exploitable without logging in · 2 with public exploit code · latest Sep 9, 2026

Listed on wordpress.org · latest 3.8.7 · last updated Oct 1, 2026 · 20K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2023-23813unauthenticated · needs a click≤ 3.4.3

    WordPress My Calendar Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2022-47427unauthenticated · needs a click≤ 3.3.24.1

    WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-6854unauthenticated≤ 3.7.8

    My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters

    High 7.5

  • CVE-2024-25916login required≤ 3.4.23

    WordPress My Calendar plugin <= 3.4.23 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

  • CVE-2026-77187contributor+≤ 3.8.3

    My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

    Medium 6.4

  • CVE-2026-77186contributor+≤ 3.8.3

    My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

    Medium 6.4

  • CVE-2026-2355contributor+≤ 3.7.3

    My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    Medium 6.4

  • CVE-2019-15713unauthenticated · needs a click

    The my-calendar plugin before 3.1.10 for WordPress has XSS.

    Medium 6.1

  • CVE-2026-11896unauthenticated≤ 3.7.14

    My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter

    Medium 5.3

  • CVE-2026-7525login required≤ 3.7.9

    My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

    Medium 4.3

  • CVE-2025-67592login required≤ 3.6.16

    WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2012-6527

    Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary w

    Low 2.6

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory